Bring Your Own IP (BYOIP) address to IONOS Cloud

Overview

Bring Your Own IP (BYOIP) and Autonomous System Number (BYOASN) to the IONOS Cloud for greater control over your network architecture.

• With BYOIP, you can register and manage your public IP address ranges (IPv4 or IPv6) elsewhere and bring them for use within IONOS Cloud to maintain IP reputation, simplify migration, retain ownership, and ensure consistent network identity across environments.

• With BYOASN support, you can allow your public IP addresses (which you brought using BYOIP) to be advertised on the internet using your ASN instead of IONOS Cloud's ASN, thereby preserving your ASN reputation, simplifying migration, and enabling seamless direct peering.

Both features are ideal for organizations that manage large, distributed networks or require tight control over internet routing. By combining BYOIP and BYOASN, you gain the flexibility to operate your network logic within our infrastructure securely, reliably, and on your terms within IONOS Cloud´s infrastructure.

This documentation outlines the process for integrating your own IP address range into the IONOS Cloud platform through the RIPE NCC.

1. Download the appropriate approval letter in the language of your choice:

EN

80KB

Letter_of_authorization_EN.pdf

PDF

Open

DE

ES

FR

UK

1. Complete and send the approval letter to the IONOS Cloud Support. This tutorial outlines the necessary steps and requirements for preparing and submitting the letter.

Prerequisites

• Provide an IPv4 address range. IPv6 is currently not supported.

• Each submitted subnet must be at least /24 (256 IP addresses minimum). Smaller subnets are not eligible for onboarding.

• You have the exclusive right to the provided IPv4 address range.

• Additionally, the IP block must never be announced on the internet at the time of your request or at any point afterward. Announcing the IP block prematurely can cause unintended anycast routing, potentially causing partial or full outages. Proper withdrawal of the prefix from all other internet announcements before this process is critical to maintain service stability.

Key concepts

• IP Prefix: Define blocks of IP addresses (prefixes) you want to advertise and route. With BYOIP, you control how and where you use the IP prefixes.

• Border Gateway Protocol (BGP): Use BGP to establish routing sessions between your ASN and IONOS Cloud, enabling the dynamic exchange of routing information.

• Resource Public Key Infrastructure (RPKI): A security framework that uses cryptographic certificates to verify that an Autonomous System (AS) is authorized to announce specific IP prefixes, helping to prevent route hijacking and misconfigurations.

• Route Origin Authorization (ROA): For secure global BGP routing, create ROAs to verify that your ASN is authorised to announce specific IP prefixes.

• Routing Policy Specification Language (RPSL): A standardized language used to describe routing policies in Internet Routing Registry (IRR) databases. It defines how prefixes are announced, filtered, and propagated.

• Peering: To optimize traffic flow, initiate direct routing relationships (peering) between your ASN and IONOS Cloud or external networks.

• Route Propagation: Control how your advertised routes spread within and across our network regions, influencing traffic paths and failover behaviour.

Benefits

BYOIP and BYOASN offer unparalleled control and flexibility over your network infrastructure. With these features, you can:

• Eliminate IP Costs: Leverage your existing IP address ranges and ASNs without incurring additional leasing or rental fees, reducing operational expenses.

• Predictable Traffic Billing: Enjoy predictable billing for traffic to and from your BYOIP/BYOASN addresses, with rates consistent with our platform-managed IPs, making it easier to manage your budget.

• Enhanced Security: Automatically benefit from our built-in DDoS protection for all onboarded IPs, with no extra configuration required, ensuring your network is secure and resilient.

• Rapid Deployment: Get your BYOIP/BYOASN resources up and running quickly, with onboarding and routing typically activated within five business days, so you can start using them immediately.

• Global Reach: Deploy your BYOIP/BYOASN across all our infrastructure locations worldwide, giving you the flexibility to reach your audience anywhere, anytime.

Configuration requirements for BYOIP onboarding

To ensure smooth onboarding to BYOIP, provide the following parameters:

• Customer Identification: Specify your full name and associated contract number to ensure accurate account mapping.

• IP Prefix: Provide an IP prefix of /24 or larger. Prefixes smaller than /24 (example:/25) violate BGP best practices and will be filtered by most internet routers.

• Data Center Preference: Indicate the desired data center for deployment to enable efficient resource allocation. To view the list of currently available locations , see External Network.

• Regional Internet Registry (RIR) Database: This guide provides instructions for RIPE NCC. If your addresses are registered with a different RIR (Example: ARIN, APNIC), the specific steps will differ. However, the principles of creating route objects and ROAs remain the same.

Execution

To configure and secure your IP addresses and Autonomous System Numbers and fulfil the requirements specified in the approval letter, follow these steps:

BYOIP

1

Register in the IRR Database

1. Log in to RIPE LIR portal with your username and password.

Info: This will give you access to the various areas of the IRR database where you can manage your IP address ranges, Route Objects, and Resource Public Key Infrastructure - Route Origin Authorizations (RPKI-ROAs).

RIPE LIR portal

Note: If you maintain multiple organizations, select the correct organization in the top right. If you are not, you can continue to the next step.

2

Create route objects

1. Navigate to the menu on the left and open RIPE Database > Create an Object.

2. Select a route for IPv4 address and click Create.

Select object type

1. Add the following information:

Components	Description
Route	Add the prefix you would like to bring to IONOS Cloud.
Origin	AS8560 is the Autonomous System Number (ASN) of IONOS Cloud and will be used to originate the prefix on the Internet. Add AS8560 .

Route properties

1. Select SUBMIT to create the object.

Result: This action officially records IONOS Cloud's authorization to announce the specified prefix in the global Internet routing table.

3

Create and update RPKI ROAs

Info: Resource Public Key Infrastructure (RPKI) enhances routing security by cryptographically verifying that only authorized Autonomous Systems can announce specific IP prefixes. This prevents route hijacking and unauthorized announcements. IONOS Cloud requires all BYOIP and BYOASN prefixes to be RPKI validated.

1. Navigate to the menu on the left and open RPKI > ROAs and open the ROAs tab.

2. Click on Create new ROA.

Create new ROA

Warning: If you have not used RPKI before, you need to configure a certificate authority. For more information on how to set up RPKI using a managed certificate, refer to the RIPE NCC Documentation.

1. Make sure that the RPKI-ROA is formatted correctly and contains all the necessary information by entering the following information:

Components	Description	Example
IP address range	The IP address range must be listed correctly, including the start and end IP address.	85.215.0.0/15
Prefix length	The maximum prefix length is /24 for IPv4.	/24
Origin AS	The origin AS must be listed as AS8560 for BYOIP.	AS8560

Select object type

1. Click Save and Apply Now to save the changes.

BYOASN

Result: Your IP addresses and ASNs are now properly configured, secured, and fully compliant with the approval letter requirements.

Conclusion

Once the approval letter is received, it may take up to 5 business days for processing. After that, the requested IP addresses will appear as a single IP block within IP Management. You can use this block to provision any service.

Warning: To prevent accidental loss, make sure the IP block is not deleted from the DCD or using the Cloud API. To release the IP adresses, contact the IONOS Cloud Support.